Resource Hijacking
- ID
- T1496
- Tactics
- TA0040 Impact
- Platforms
- Windows, IaaS, Linux, macOS, Containers, SaaS
- Data sources
- Process Creation, Host Status, Network Connection Creation, Network Traffic Flow, Network Traffic Content, Instance Start, Cloud Service Modification, Application Log Content
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability.
Resource hijacking may take a number of different forms. For example, adversaries may:
- Leverage compute resources in order to mine cryptocurrency
- Sell network bandwidth to proxy networks
- Generate SMS traffic for profit
- Abuse cloud-based messaging services to send large quantities of spam messages
In some cases, adversaries may leverage multiple types of Resource Hijacking at once.[1]
Sub-techniques (4)
- T1496.001 Compute Hijacking
- T1496.002 Bandwidth Hijacking
- T1496.003 SMS Pumping
- T1496.004 Cloud Service Hijacking
Detection
- DET0267 Resource Hijacking Detection Strategy
Data components: Process Creation, Host Status, Network Connection Creation, Network Traffic Flow, Network Traffic Content, Instance Start, Cloud Service Modification, Application Log Content